NSE7 Practice Test 37 — 15 Questions

Question 1

An administrator is troubleshooting an issue where a FortiGate is not forwarding traffic between two internal subnets. The administrator runs 'diagnose debug flow' and sees that packets are entering the FortiGate but are dropped with the message 'reverse path check fail, drop'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asymmetric routing: the return path for the traffic is through a different interface than the FortiGate expects.. The 'reverse path check fail' drop indicates that the FortiGate received a packet on an interface but the route back to the source would use a different interface. This is characteristic of asymmetric routing. The FortiGate performs a reverse path forwarding check to prevent spoofing and ensure symmetric routing. To resolve, the administrator can either fix the routing to be symmetric or disable the reverse path check on the interface, though that reduces security.

Answer

The FortiGate's routing table does not have a route to the destination subnet.

Answer

A firewall policy is missing to allow traffic between the two subnets.

Answer

The two subnets are in the same zone, and intra-zone traffic is denied by default.

Question 2

A network administrator is troubleshooting why a FortiGate does not appear to be enforcing a newly configured application control profile. The policy is applied to traffic from the internal network to the internet. The administrator runs 'diagnose sys session list' and sees that sessions are being created, but the application control profile is not listed in the session details. Which action should the administrator take to verify that the application control profile is being applied?

Accepted Answer

Use 'diagnose sys session filter' to filter sessions by the policy ID and then run 'diagnose sys session list' to check if the application control profile is referenced.. To verify that an application control profile is being applied to a session, the administrator should filter sessions by the policy ID and list them. The session output includes the UTM profiles associated with the session. This method provides definitive evidence of whether the profile is active, unlike global statistics or logs that may not reflect per-session enforcement.

Answer

Check the FortiGate's event log for application control violations.

Answer

Run 'diagnose debug application ipsmonitor -1' to check if the IPS engine is inspecting the traffic.

Answer

Run 'diagnose test application appctrl 1' to display the application control statistics.

Question 3

A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?

Accepted Answer

A large volume of traffic is being inspected by IPS, possibly due to a DoS attack.. The ipsengine process handles Intrusion Prevention System (IPS) inspection. High CPU usage by ipsengine typically indicates that the FortiGate is processing a large volume of traffic through IPS signatures, which is computationally intensive. This is often triggered by a DoS attack or a sudden surge in traffic that requires deep packet inspection, overwhelming the CPU.

Answer

The firewall is experiencing a memory leak.

Answer

The antivirus engine is scanning large files.

Answer

There is a routing loop causing packet bouncing.

Question 4

Refer to the exhibit. A tunnel interface is configured with IP 10.0.1.1/30 and remote-ip 10.0.1.2/30. The phase2 defines src-subnet as 10.0.1.0/30 and dst-subnet as 10.0.2.0/30. What is the most likely problem with this configuration?

Accepted Answer

The phase2 src-subnet includes the tunnel interface IP. The phase2 src-subnet is set to 10.0.1.0/30, which includes the tunnel interface IP 10.0.1.1/30. In IPsec VPN configurations, the phase2 selector must not include the tunnel interface IP itself because the tunnel interface is used for routing encapsulated traffic; including it can cause routing loops or prevent the tunnel from establishing correctly. The correct src-subnet should be the protected internal network behind the FortiGate, not the tunnel subnet.

Answer

The remote gateway is set to a static IP but the peer might be dynamic

Answer

The tunnel interface is missing the 'ip' command

Answer

The phase2 dst-subnet overlaps with the remote gateway

Question 5

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

Accepted Answer

The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.. FortiGate A-P clusters synchronize sessions via the HA heartbeat interface, but local-in traffic (e.g., management sessions like HTTPS, SSH, or SNMP) is never synchronized because it is destined to the cluster IP itself and is inherently unit-specific. The 'diagnose sys ha session-sync status' command shows a session count mismatch because the primary unit has local-in sessions that the secondary does not replicate, making D the correct answer.

Answer

The session is using a custom application control profile that prevents synchronization.

Answer

The HA heartbeat interface is down.

Answer

The secondary unit has insufficient memory to accept new sessions.

Question 6

A FortiGate administrator needs to verify that the firewall is correctly identifying and logging a specific application, 'Facebook', that is being used by internal users. The administrator has already configured an application control profile with logging enabled for Facebook. Which CLI command should the administrator use to view the application control logs in real-time?

Accepted Answer

diagnose debug application appctrl -1. To view application control logs in real-time, the administrator should use the debug command for the application control daemon. The 'diagnose debug application appctrl -1' command provides detailed output about application identification and logging decisions. This is more specific than general debug commands and directly addresses the need to verify that Facebook is being identified and logged. Other commands like ipsmonitor debug or session list do not provide the same level of detail for application control logs.

Answer

diagnose debug enable

Answer

diagnose sys session list

Answer

diagnose debug application ipsmonitor -1

Question 7

An administrator configures an automation stitch in FortiManager to execute a CLI script on a FortiGate when a specific event is triggered. The automation stitch is enabled but does not run when the event occurs. What is the most likely cause?

Accepted Answer

The automation stitch has not been installed to the FortiGate. In FortiManager, automation stitches are created and stored in the central management database but must be explicitly installed to the managed FortiGate via the 'Install Wizard' or a direct policy/object install. Until the stitch is installed, the FortiGate does not have the configuration locally, so even if the stitch is enabled in FortiManager and the event occurs, the FortiGate will not execute the CLI script. This is a common oversight where administrators assume enabling the stitch in FortiManager automatically pushes it to the device.

Answer

The event trigger is set to high severity only

Answer

The FortiGate does not support automation stitches

Answer

The CLI script contains an invalid command

Question 8

An administrator needs to isolate customer traffic in a FortiGate deployed at a service provider. Each customer should have independent administrators and security policies. Which feature should be used?

Accepted Answer

Virtual domains (VDOMs). Virtual domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own administrators, security policies, routing tables, and interfaces. This is the correct feature for isolating customer traffic at a service provider because it provides complete administrative and policy separation per customer, which VLAN interfaces alone cannot achieve.

Answer

VLAN interfaces

Answer

Policy packages

Answer

Administrative domains (ADOMs)

Question 9

What is the primary purpose of FortiGuard Outbreak Prevention service?

Accepted Answer

To provide proactive protection against zero-day and fast-spreading threats. FortiGuard Outbreak Prevention is designed to provide proactive protection against zero-day and fast-spreading threats by leveraging real-time threat intelligence from FortiGuard Labs. It automatically updates security policies and signatures to block emerging threats before they become widespread, reducing the window of vulnerability.

Answer

To provide real-time threat intelligence feeds to third-party SIEM systems

Answer

To automatically patch vulnerabilities in FortiGate firmware

Answer

To block all traffic from IP addresses listed in a community-based blocklist

Question 10

An administrator configures FortiSandbox inline scanning for HTTP traffic. They notice that files uploaded via HTTP are being scanned but no verdict is being returned, causing delays. What is the MOST likely cause?

Accepted Answer

The file scan timeout is too short, causing FortiGate to pass the file before a verdict is received. When FortiGate sends a file to FortiSandbox for inline scanning, it waits for a verdict before allowing the traffic to proceed. If the file scan timeout is too short, FortiGate will stop waiting for the verdict and pass the file anyway, causing the observed delay without a final verdict. This is the most likely cause because the administrator sees scanning occurring but no verdict returned, which aligns with a premature timeout rather than a failure to scan.

Answer

The FortiSandbox has reached its maximum storage capacity

Answer

The FortiSandbox is not registered with the FortiGate

Answer

The file type is not supported by FortiSandbox

Question 11

What is the purpose of a header policy in a FortiManager policy package?

Accepted Answer

To define policies that are inserted at the beginning of the policy list. A header policy in a FortiManager policy package is used to define policies that are inserted at the beginning of the policy list, before any other policies. This ensures that certain traffic matching criteria (e.g., from specific sources or to specific destinations) is evaluated first, which is critical for enforcing high-priority rules like allowlisting or blocking specific traffic before more general policies are applied.

Answer

To apply policies to the management VDOM

Answer

To create policies that bypass security profiles

Answer

To specify the name of the policy package

Question 12

A FortiGate admin notices that HTTPS traffic to a web server is not being scanned by the antivirus profile applied to the firewall policy. The admin confirms the policy is correct and antivirus is enabled. What is the MOST likely reason the traffic is not being scanned?

Accepted Answer

SSL/TLS deep inspection is not enabled on the firewall policy. When HTTPS traffic is not scanned by an antivirus profile despite the policy being correct and antivirus enabled, the most likely cause is that SSL/TLS deep inspection is not enabled on the firewall policy. Without deep inspection, FortiGate cannot decrypt the encrypted HTTPS payload, so the antivirus engine sees only encrypted data and cannot scan for malware. Enabling deep inspection with a valid CA certificate allows FortiGate to perform man-in-the-middle decryption and then apply antivirus scanning to the decrypted content.

Answer

The web server's certificate is self-signed and FortiGate is rejecting the connection

Answer

The FortiGuard antivirus subscription has expired

Answer

The antivirus profile is configured for flow-based inspection instead of proxy-based

Question 13

An administrator configures a route map on a FortiGate to redistribute connected routes into OSPF. The route map sets a metric of 100. After applying, the redistributed routes appear with metric 20. What is the most likely reason?

Accepted Answer

The route map is not applied to the redistribution configuration. The most likely reason the redistributed routes appear with metric 20 instead of the configured 100 is that the route map was not applied to the redistribution configuration. In FortiGate OSPF redistribution, a route map must be explicitly referenced under the 'redistribute connected' command; otherwise, the route map is ignored, and OSPF uses its default metric of 20 for redistributed connected routes.

Answer

The route map is applied to the wrong direction

Answer

OSPF does not allow metric setting via route maps

Answer

The metric type is set to type 1

Question 14

A multinational corporation is implementing ZTNA for remote access to a critical internal application hosted on a server with IP 10.0.1.200:8443. The FortiGate is deployed at the edge with WAN IP 203.0.113.50. The administrator configures a ZTNA rule with proxy destination 10.0.1.200:8443, a firewall policy allowing traffic from the ZTNA gateway to the internal server, and a VIP for port forwarding for testing. However, remote users report that they can establish a ZTNA connection to the gateway but the application page fails to load, showing a blank page after a long delay. The FortiGate logs show no errors, and the debug output indicates that the proxy successfully forwarded the request to 10.0.1.200:8443 and received a response. The internal server team confirms the application is working correctly for on-site users. What is the most likely cause?

Accepted Answer

The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally.. The application uses hardcoded IP addresses or internal hostnames that are not resolvable externally. When the ZTNA proxy forwards the request to the internal server, the server responds with HTML content that references internal resources (e.g., images, scripts, or links) using private IP addresses (like 10.0.1.200) or internal DNS names. The remote client cannot resolve or reach these internal addresses, causing the page to load partially or display a blank page after a delay, even though the initial proxy connection and response are successful.

Answer

The ZTNA proxy is not configured to support HTTPS.

Answer

The internal server is not reachable from the FortiGate.

Answer

The client's ZTNA tags are expired.

Question 15

A FortiGate is managed by FortiManager. The administrator creates a new policy package for VDOM 'Sales' and installs it. Later, they find that the previous configuration has been overwritten. What should the administrator do to avoid this in the future?

Accepted Answer

Use the install preview before applying the changes. Using the install preview allows the administrator to review the exact changes that will be applied to the FortiGate before committing them. This prevents accidental overwrites by showing a diff of the configuration, enabling the administrator to verify that the new policy package will not replace existing settings unintentionally.

Answer

Set the FortiGate to backup mode

Answer

Enable auto-lock on the policy package

Answer

Enable revision history